MSRC-CVE-2023-38186 — Windows Mobile Device Management Elevation of Privilege Vulnerability

Summary

Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

What privileges could be gained by an attacker who successfully exploited this vulnerability?
An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.

According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability?
Any authenticated attacker could trigger this vulnerability. It does not require admin or other elevated privileges.

Security updates
10.0.20348.1906 — https://support.microsoft.com/help/5029250
10.0.20348.1903 — https://support.microsoft.com/help/5029367
10.0.22000.2295 — https://support.microsoft.com/help/5029253
10.0.19044.3324 — https://support.microsoft.com/help/5029244
10.0.22621.2134 — https://support.microsoft.com/help/5029263

Vulnerabilities 1

High 8.8

CVE-2023-38186

Windows Mobile Device Management Elevation of Privilege Vulnerability

Windows Mobile Device Management Elevation of Privilege Vulnerability

Microsoft Windows Server 2022 Windows 10 Version 21H2 Windows 10 Version 22H2 Windows

Aug 8, 2023

Revision history

2023-10-17 #2
Updated one or more CVSS scores for the affected products and added an FAQ explaining the vector string settings. This is an informational change only.
2023-08-08 #1
Information published.

References

CVE-2023-38186 Windows Mobile Device Management Elevation of Privilege Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38186
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
Common Vulnerability Scoring System
https://www.first.org/cvss